CVE-2025-62584
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment. This may enable unauthorized access to data between tabs.
Risk Assessment
Bypassing the Same-Origin Policy can lead to cross-site data leakage and breach of user information confidentiality. An attacker could exploit this to steal sessions or credentials.
Recommendation
Update Whale browser to version 4.33.325.17 or later. Inform users about the risks of using outdated browser versions.
Other vulnerabilities in Whale browser
See all- CVE-2025-69234Critical
Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.
- CVE-2025-62583Critical
Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.
- CVE-2025-69235High
Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.
- CVE-2025-62585High
Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.
Original NVD description (English source)
Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS